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DETAILED) ACTION 



Information Disclosure Statement 



1. The information disclosure statement (IDS) submitted on 5/2/2001 was filed after the 
mailing date of the application on 08/17/2000. The submission is in compliance with the 
provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being 
considered by the examiner. 



2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

3. Claims 1,2, 3, 4, 5, 6, 10, 11, 12, 13 14, and 15 are rejected under 35 U.S.C. 103(a) as 

being unpatentable over Kosbab U.S Patent No. 5917808 in view of Diebboll U.S. Patent 
No. 5886643 in further view of McKee U.S. Patent No. 5712981. 

Regarding claim 1, Kosbab discloses a method for identifying devices on a local area 
network (Ethernet) using passive monitoring. This method, includes receiving network traffic in 
form of frames, see col.4 lines 46-47. It is well known in the art that the Ethernet frame contain 
information about the destination, source, type of protocol used, etc. In addition to the 
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mentioned information, information of the frame count, is received, see col. 5 lines 14-15. 
Kosbab also disclose a method that compares the frame type information with server frame type 
wherein this means identifying data to one or more protocols in order to identify a server, see 
col. 8 lines 16-20. Kosbab complies with the limitations on claim 1 which includes receiving 
data containing source device, destination device, data transfer protocol, and volume of 
information. 

But Kosbab fails to disclose to determine as a server the device with the highest data 
volume for communications in which is the source or destination device. 

However Diebboll teaches an method and apparatus for discovering network topology in 
which explains that a network manager can ask the system to identify all of the servers that a 
particular node is talking to, identify all of the traffic between two identified nodes, and also 
protocols that are being used over the particular line. These additional data is stores in a 
database in storage where each one is associated between a particular source-destination node 
pair, see col. 5 lines 25-33. A server in a client server/ configuration receives a request from a 
client and supplies files or services to the client. When the server receives the request is acting 
as a destination device and when supplies files or services is acting as a source. It is well known 
in the art that a server due to the traffic of receiving request and providing services and/or files is 
the device with highest traffic in the network. Diebboll also teaches, identifying the probe with 
the highest total count, see col. 8 lines 8-11. Diebboll also complies with part of the limitations in 
claim 1 which include that the server is either the source or destination device and that the device 
has the highest data volume. 
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Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by Diebboll. One of ordinary skill in the art would have been 
motivated to do this combination in order to have a more precise method to identify servers. 
Kosbab teaches that frames contain information that may be uniquely associated with specific 
type of network device, but gives an example to identify a router and it says that frames 
containing router information protocol messages "may" be assumed to be generated by one or 
more routers, see Kosbab col.3 lines 5-10. 

The combination of Kosbab and Diebboll discloses all the limitations above but fails to 
disclose to determine that the communication involve at least a threshold number of other 
devices. 

However McKee discloses a network analysis for identify global and local node servers 
in where explains that identifying a local server with the highest linkage where the linkage of a 
node with other nodes are measured in terms of at least number of associated nodes, number of 
frames involved in the traffic, or number of bytes involved in the traffic, see col.2 lines 7-20. 
McKee complies with the limitation in claim one of identify the device, which involve at least a 
threshold number of other devices. 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by McKee. One of ordinary skill in the art would have been 
motivated to do this combination in order to have a more precise method to identify servers. 
Kosbab teaches that frames contain information that may be uniquely associated with specific 
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type of network device, but gives an example to identify a router and it says that frames 
containing router information protocol messages "may" be assumed to be generated by one or 
more routers, see Kosbab col.3 lines 5-10. 

Regarding claim 2, the combination of Kosbab, Diebboll, and McKee discloses all the 
limitations in claim 1 and also a method to identify data related to server protocols, which 
comprises comparing the frame information (protocols) to server frame types and if there is a 
match between the frame information and any of the server frame type, identify entry as a server, 
see Kosbab col. 8 lines 16-41. 

Regarding claim 3, the combination discloses all the limitations in claim 2, and also 
teaches, that after comparing the frame information with the server frame type, and having a 
match, the corresponding entry is tagged as a server, see Kosbab col. 8 lines 36-41 . 

Regarding claim 4, the combination discloses all the limitations in claim 1, and also 
discloses identifying global and local servers depending on the depth of the detail provided by 
the traffic data. The traffic data can be simply based on source and destination node address of 
message packets passed across the network, see McKee col. 7 lines 6-14. In addition, determine 
the total counts for all the identified probes in where that probe is the one with the best data 
about the conversation between the selected source-destination node pair, see Diebboll col. 8 
lines 8-13. 

Regarding claim 5, the combination discloses all the limitations in claim 4, and also 
disclose that after the total count have been computed for al the identified probes, the network 
management system identifies the probe with the highest total count, see Diebboll col. 5 lines 8- 
11. 
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Regarding claim 6, the combination discloses all the limitations in claim 5, and also 
discloses determining the number and types of devices that are present in the LAN for purpose of 
maintenance and troubleshooting, see Kosbab col. 2 lines 21-23. 

Regarding claim 10, the combination discloses all the limitations in claim 1, and 
receiving data of the network traffic in form of frames, see Kosbab col.4 lines46-47. 

Regarding claim 11, the combination disclose all the limitations in claim 10, and also 
collecting frame information with a test instrument connected to the LAN, see col. 3 lines 33-36, 
where the network device determine the types of devices on a LAN by passively monitoring 
network traffic, see Kosbab col.3 lines 44-46. 

Regarding claim 12, the combination disclose all the limitations in claim 11, and that the 
data is collected over a predetermined period of time desired by the user of the test instrument, 
see Kosbab col. 7 lines 13-16. 

Regarding claim 13, discloses all the limitations in claim 11, where the network data is 
RMON 2 data. RMON 2 is a specifies protocol for communicating with the probe and it 
specifies the format of the Management Information Base (MIB), see Diebboll col.4 lines 38-42. 
The RMON collects 9 kinds of information including packet sent, bytes sent, packet dropped, 
statistic by host, conversation between two address, and other events that occur. The probe used 
is a program or other device inserted at a key junction in a network for the purpose of monitoring 
or collecting data about the network activity. 

Regarding claim 14, the combination discloses all the limitations in claim 1 and by 
definition of network that is a group of computers and associated devices that are connected by 
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communication facilities, the threshold number, that is the number of other devices, is grater than 
one. 

Regarding claim 15, the combination discloses, all the limitations in claim 1 and also 
disclose relevant server protocols as TCP/IP BOOTP, TCP/IP DNS, TCP/IP WINS, TCP/IP 
DHCP, IPX SAP, IPX, and Net BIOS, Kosbab see col.8 lines 20-33. 

4. Claims 16, 17, 18, 19, 20, 21, 24, and 25 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kosbab U.S Patent No. 5917808 in view of Diebboll U.S. Patent No. 
5886643 in further view of McKee U.S Patent No. 5712981. 

Regarding claim 16, Kosbab discloses a method for identifying device types on a local 
area network (Ethernet) using passive monitoring using a test device. Such test device 
containing a frame processor that can be implemented in hardware, software, or a combination 
thereof, see fig.3 and col.4 lines 54-56. The frame processor in the test instrument receives 
frames on the network using the TCP/IP protocol. Such frames, contains information of source, 
destination, and type of data (protocol), provided in the Ethernet frame, and the frame count, see 
col. 5 line 14. The frame information, as it arrives, is compared against sets of frame types, 
which each type is uniquely associated with one of the network device types (protocols), see 
col.3 lines 18-24. Such information can be used to determine a device as a server, see col. 5 
lines 59-63. Kosbab complies with some of the limitations in claim 16, which includes a frame 
processor which can be implemented in software, that receives data containing source device, 
destination device, data transfer protocol, and frame count or volume of information, and that the 
software is for identifying data relating to one or more relevant server protocols or frame types. 
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But Kosbab fails to disclose a software to determine as a server, the device with the 
highest data volume for communications in which is the source or destination device. 

However Diebboll teaches an algorithm that can be a computer program cause is 
implemented on a apparatus, in which identify all source-destination node pairs for which the 
conversation have been recorder and identify the probe that produces the highest count, see fig.4. 
A server in a client server/ configuration receives a request from a client and supplies files or 
services to the client. When the server receives the request is acting as a destination device and 
when supplies files or services is acting as a source. It is well known in the art that a server due 
to the traffic of receiving request and providing services and/or files is the device with highest 
traffic in the network. Diebboll also complies with part of the limitations in claim 16 which 
include a software for identify that the server is either the source or destination device and that 
determines the device with the highest data volume. 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by Diebboll One of ordinary skill in the art would have been 
motivated to do this combination in order to have a more precise method to identify servers. 
Kosbab teaches that frames contain information that may be uniquely associated with specific 
type of network device, but gives an example to identify a router and it says that frames 
containing router information protocol messages "may" be assumed to be generated by one or 
more routers, see Kosbab col.3 lines 5-10. 
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The combination of Kosbab and Diebboll discloses all the limitations above but fails to 
disclose to determine that the communication involve at least a threshold number of other 
devices. 

However McKee discloses a network analysis for identify global and local node servers 
in where explains that identifying a local server with the highest linkage where the linkage of a 
node with other nodes are measured in terms of at least number of associated nodes, number of 
frames involved in the traffic, or number of bytes involved in the traffic, see col.2 lines 7-20. 
McKee complies with the limitation in claim one of identify the device, which involve at least a 
threshold number of other devices. 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by McKee. One of ordinary skill in the art would have been 
motivated to do this combination in order to have a more precise method to identify servers. 
Kosbab teaches that frames contain information that "may" be uniquely associated with specific 
type of network device, but gives an example to identify a router and it says that frames 
containing router information protocol messages may be assumed to be generated by one or more 
routers, see Kosbab col. 3 lines 5-10. 

Regarding claim 17, the combination of Kosbab, Diebboll, and McKee discloses all the 
limitations in claim 16, and also a software which comprises comparing the frame information 
(protocols) to server frame types and if there is a match between the frame information and any 
of the server frame type, identify entry as a server, see Kosbab col. 8 lines 16-41 . 
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Regarding claim 18, the combination discloses all the limitations in claim 17, and also 
teaches an algorithm that after identify the probe that produces the highest count, tag all the 
records for that probe (210), see Diebboll fig. 2. 

Regarding claim 19, the combination discloses all the limitations in claim 16, and also 
disclose an algorithm that identifies all source-destination node pair for which conversation has 
been recorded (200), for the selected one of the identified probes, add up the total normalized 
packet counts to compute a total count (206), and repeat until the step (206) is done to the rest of 
the identified probes (208), see Diebboll fig.4. 

Regarding claim 20, the combination discloses, all the limitations in claim 19, and also 
discloses an algorithm that identifies the probe that produces the highest count (210), see 
Diebboll fig.4 

Regarding claim 21, the combination discloses all the limitations in claim 20, and also 
discloses a software in the test instrument to determine the number and types of devices that are 
present in the LAN, see Kosbab col.2 lines 21-23. 

Regarding claim 24, the combination discloses all the limitations in claim 16, where at 
the frame processor of the test instrument can be implemented as software. The frame 
information is stores in a database, which the database has a table with the source and frame 
count fields, wherein frame counts means the volume of information, see Kosbab fig.4. But 
Kosbab fails to disclose the data in the table having the fields of source, destination, application, 
and volume of data. 
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However Diebboll et al. discloses that the retrieved data is stored in a database in an 
external storage, see col. 5 line 30-32. Such database includes several fields including the source, 
destination, the number of packets, and the protocol used, see fig. 2, 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by Diebboll. One of ordinary skill in the art would have been 
motivated to do this combination in order store in the database the best information about the 
traffic between two identified nodes, see Diebboll col. 6 lines 26-27. "A network manager can 
ask the system to identify all of the servers that a particular node is talking to; to identify all of 
the traffic between two identified nodes; to identify the protocols that are being used over a 
particular line; etc.", see Diebboll col. 5 lines 25-29. 

Regarding claim 25, the combination discloses all the limitations in claim 24, and also 
discloses that the network data is RMON 2 data. RMON 2 is a specifies protocol for 
communicating with the probe and it specifies the format of the Management Information Base 
(MIB), see Diebboll col.4 lines 38-42. The RMON collects 9 kinds of information including 
packet sent, bytes sent, packet dropped, statistic by host, conversation between two address, and 
other events that occur. The probe used is a program or other device inserted at a key junction in 
a network for the purpose of monitoring or collecting data about the network activity. 
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5. Claims 26, 27, and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kosbab US Patent No. 5917808 in view of Diebboll et al. U.S. Patent No. 5886643 in 
further view of McKee U.S. Patent No. 5712981. 

Regarding claim 26, Kosbab discloses an apparatus to identify device types on a network 
comprising of a test instrument with a frame processor connected to the network that collect and 
receives network traffic in form of frames, see col.3 lines 2-18. Kosbab also discloses that the 
LAN (Ethernet) is operating according to the TCP/IP protocol. The data in form of frames 
contain information such as source address and destination address, and data transfer protocol, 
which is contained in the Ethernet frame. The information also contains frame count, see col. 5 
line 14. The frame processor uses the frame information and compares it, against set of frame 
types; where each frame type is uniquely associated with one of the network device type, see 
col.3 lines 15-25. For identifying data to determine as a server device, the frame information is 
compared with server frame types, see col. 8 lines 16-40. Kosbab comply with the limitations 
described in claim 26 which includes a network device, as a test instrument, to collect data 
representing communications on the network (frames) that contain information about the source 
device, destination device, data transfer protocol, obtain from the Ethernet frame and data 
volume information (frame count). It also includes a processor for receiving the data for 
identifying data relating to one or more server protocol (frame type) were such data is used to 
identify such device as a server. 

But Kosbab fails to disclose to determine as a server the device with the highest data 
volume for communications in which is the source or destination device. 
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However Diebboll teaches an method and apparatus for discovering network topology in 
which explains that a network manager can ask the system to identify all of the servers that a 
particular node is talking to, identify all of the traffic between two identified nodes, and also 
protocols that are being used over the particular line. These additional data is stores in a 
database in storage where each one is associated between a particular source-destination node 
pair, see col. 5 lines 25-33. A server in a client server/ configuration receives a request from a 
client and supplies files or services to the client. When the server receives the request is acting 
as a destination device and when supplies files or services is acting as a source. It is well known 
in the art that a server due to the traffic of receiving request and providing services and/or files is 
the device with highest traffic in the network. Diebboll also teaches, identifying the probe with 
the highest total count, see col. 8 lines 8-11. Diebboll also complies with part of the limitations in 
claim 1 which include that the server is either the source or destination device and that the device 
has the highest data volume for communication. 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by Diebboll. One of ordinary skill in the art would have been 
motivated to do this combination in order to have a more precise method to identify servers. 
Kosbab teaches that frames contain information that may be uniquely associated with specific 
type of network device, but gives an example to identify a router and it says that frames 
containing router information protocol messages "may" be assumed to be generated by one or 
more routers, see Kosbab col. 3 lines 5-10. 
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The combination of Kosbab and Diebboll discloses all the limitations above but fails to 
disclose to determine that the communication involve at least a threshold number of other 
devices. 

However McKee discloses a network analysis for identify global and local node servers 
in where explains that identifying a local server with the highest linkage where the linkage of a 
node with other nodes are measured in terms of at least number of associated nodes, number of 
frames involved in the traffic, or number of bytes involved in the traffic, see col 2 lines 7-20. 
McKee complies with the limitation in claim one of identify the device, which involve at least a 
threshold number of other devices. 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by McKee. One of ordinary skill in the art would have been 
motivated to do this combination in order to have a more precise method to identify servers. 
Kosbab teaches that frames contain information that may be uniquely associated with specific 
type of network device, but gives an example to identify a router and it says that frames 
containing router information protocol messages "may" be assumed to be generated by one or 
more routers, see Kosbab col. 3 lines 5-10. 

Regarding claim 27, the combination of Kosbab, Diebboll, and McKee disclose al the 
limitations in claim 26, and also discloses a pictorial representation of the stations database, 
where the table present in form of a table the network address, Mac address device name, the 
frame count, error count, and node type, see fig. 4. Kosbab also discloses that the fields are 
defined according to the preferred embodiment for storing information gathered from the 
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network devices, see col. 5 lines 6-8. But Kosbab fails to disclose the data in the table having the 
fields of source, destination, application, and volume of data. 

However Diebboll et al discloses a method and apparatus for discovering network 
topology in which teaches that the retrieved data is stored in a database in an external storage, 
see col. 5 line 30-32. Such database includes several fields including the source, destination, the 
number of packets, and the protocol used, see fig. 2. 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by Diebboll et al. One of ordinary skill in the art would have been 
motivated to do this combination in order store in the database the best information about the 
traffic between two identified nodes, see col. 6 lines26-26. "A network manager can ask the 
system to identify all of the servers that a particular node is talking to; to identify all of the traffic 
between two identified nodes; to identify the protocols that are being used over a particular line; 
etc.", see col. 5 lines 25-29. 

Regarding claim 28, the combination of Kosbab, Diebboll, and McKee disclose al the 
limitations in claim 26, and also discloses a data storage, as a memory, that comprises a database, 
see Kosbab fig. 3. 

6. Claims 7, 8,9,22, and 23 are rejected under 35 U.S.C 103(a) as being unpatentable over 
Kosbab U.S Patent No. 5917808 in view of Dieboll U.S. Patent No. 5886643 in further 
view of McKee U.S Patent No. 5712981 in further view of Maddalozzo Jr. et al. U.S 
Patent No. 5974460. 
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Regarding claim 7 and 22, the combination discloses all the limitations in claim 6 and 21, 
but fails to disclose comparing the determined number of other devices against a predetermines 
threshold number and if the number exceeds the predetermines threshold number identify the 
device with the highestst total volume as a server. However Maddalozzo teaches the method of 
comparing transfer time with a program, see fig. 5, with a predetermined threshold transfer 
time. If the transfer time exceeds the predetermine threshold time, then the transfer process is 
cut short at the predetermined time "Y" and the number of bytes transferred during that time is 
"remembered" or stored 515 (usually in system memory 207 or cache memory 205), and the 
process continues to compare 411 the results with the best site results from earlier samples, see 
col.5 lines 26-36. 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab, Diebboll and 
McKee and combining it with the invention disclosed by Maddalozzo. One way to identify a 
server is identifying the device with highest total volume, but this device, a server, must have at 
least one client. One of ordinary skill in the art would have been motivated to do this 
combination in order to compare the number of devices connected with a threshold number of 
clients. This method and program, can lead to a more precise way of identifying servers. 
Kosbab teaches that frames contain information that may be uniquely associated with specific 
type of network device, but gives an example to identify a router and it says that frames 
containing router information protocol messages "may" be assumed to be generated by one or 
more routers, see Kosbab col.3 lines 5-10. 
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Regarding claim 8 and 23, the combination of Kosbab, Diebboll, McKee, and 
Maddalozzo discloses all the limitations in claim 7 and 22, and also disclose that after the server 
is added to the local server list, then the server is removed from the active node list and to disable 
its associate traffic elements, see McKee col.9 lines 15-20. 

Regarding claim 9, the combination the combination of Kosbab, Diebboll, McKee, and 
Maddalozzo discloses all the limitations in claim 8, and also disclose that when the server is 
identified is removed from the active node list and its associated traffic elements are disabled by 
resetting of the enable flag in each of the element, see McKee col. 8 lines 42-45. The enable flag 
marks the data and by convention, when the enable flag is set, it is included in the currently 
relevant traffic data, and when the enable flag is reset, the element is excluded, see McKee col. 7 
lines 58-64. 
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Conclusion 



The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure: 

a. U.S. Pat. No. 6,263,368 Bl to Martin, which discloses network balancing for 
multi-computer server by counting message packets to/from multi-computer server. 

b. U.S. Pat. No. 6,137,782 to Sharon et al., which discloses an automatic network 
traffic analysis. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Xiomara Y. Ortiz whose telephone number is (703) 305-6783. 
The examiner can normally be reached on Monday-Thursday from 8:30AM to 5:30PM. The 
examiner can also be reached on alternate Fridays. If attempts to reach the examiner by 
telephone are unsuccessful, the examiner's supervisor, Rupal Dharia can be reached on (703) 
305-4003. Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305-3900. 
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Patent Examiner 
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